still ok

diff --git a/source3/libads/ads_proto.h b/source3/libads/ads_proto.h
index 7c0bd4e53c0c129e218b1d7045eaf2a10a90620f..39c8ab3cab9ab311f3dbe748264ed69a20d5ae87 100644 (file)
--- a/source3/libads/ads_proto.h
+++ b/source3/libads/ads_proto.h
@@ -83,7 +83,9 @@ bool ads_setspn_delete(ADS_STRUCT *ads, const char *machine_name,
 bool ads_sitename_match(ADS_STRUCT *ads);
 bool ads_closest_dc(ADS_STRUCT *ads);
 ADS_STATUS ads_connect_creds(ADS_STRUCT *ads, struct cli_credentials *creds);
-ADS_STATUS ads_connect_anon(ADS_STRUCT *ads);
+ADS_STATUS ads_connect_cldap_only(ADS_STRUCT *ads);
+ADS_STATUS ads_connect_simple_anon(ADS_STRUCT *ads);
+#define ads_connect_anon(__ads) ads_connect_simple_anon(__ads)
 ADS_STATUS ads_connect_no_bind(ADS_STRUCT *ads);
 ADS_STATUS ads_connect_machine(ADS_STRUCT *ads);
 ADS_STATUS ads_connect(ADS_STRUCT *ads);

diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c
index 6cb7b1351c7d21406bb6ec4c83ebe12aa20cbe29..38b7dd136905fa41b8696ba03882368e7eea6473 100644 (file)
--- a/source3/libads/ldap.c
+++ b/source3/libads/ldap.c
@@ -835,7 +835,15 @@ static ADS_STATUS ads_connect_internal(ADS_STRUCT *ads,
                SMB_ASSERT(creds != NULL);
        }
 
-       if (!(ads->auth.flags & (ADS_AUTH_ANON_BIND|ADS_AUTH_ANON_BIND))) {
+       if (ads->auth.flags & ADS_AUTH_ANON_BIND) {
+               /*
+                * Simple anonyous binds are only
+                * allowed for anonymous credentials
+                */
+               SMB_ASSERT(cli_credentials_is_anonymous(creds));
+       }
+
+       if (!(ads->auth.flags & (ADS_AUTH_CLDAP_ONLY|ADS_AUTH_ANON_BIND|ADS_AUTH_ANON_BIND))) {
                ads->auth.flags |= ADS_AUTH_GENERATE_KRB5_CONFIG;
        }
 
@@ -1084,10 +1092,6 @@ got_connection:
        /* Now do the bind */
 
        if (ads->auth.flags & ADS_AUTH_ANON_BIND) {
-               if (!cli_credentials_is_anonymous(creds)) {
-                       status = ADS_ERROR_NT(NT_STATUS_WRONG_CREDENTIAL_HANDLE);
-                       goto out;
-               }
                status = ADS_ERROR(ldap_simple_bind_s(ads->ldap.ld, NULL, NULL));
                goto out;
        }
@@ -1114,15 +1118,46 @@ got_connection:
 ADS_STATUS ads_connect_creds(ADS_STRUCT *ads, struct cli_credentials *creds)
 {
        SMB_ASSERT(creds != NULL);
+       /*
+        * We allow upgrades from
+        * ADS_AUTH_NO_BIND if credentials
+        * are specified
+        */
+       ads->auth.flags &= ~ADS_AUTH_NO_BIND;
+
+       /*
+        * We allow upgrades from ADS_AUTH_ANON_BIND,
+        * as we don't want to use simple binds with
+        * non-anon credentials
+        */
+       if (!cli_credentials_is_anonymous(creds)) {
+               ads->auth.flags &= ~ADS_AUTH_ANON_BIND;
+       }
+
        return ads_connect_internal(ads, creds);
 }
 
 /**
- * Connect to the LDAP server using anonymous credentials
+ * Connect to the LDAP server using without a bind
+ * and without a tcp connection at all
+ * @param ads Pointer to an existing ADS_STRUCT
+ * @return status of connection
+ **/
+ADS_STATUS ads_connect_cldap_only(ADS_STRUCT *ads)
+{
+       //ads->auth.flags |= ADS_AUTH_CLDAP_ONLY;
+       ads->auth.flags |= ADS_AUTH_NO_BIND;
+       return ads_connect_internal(ads, NULL);
+}
+
+/**
+ * Connect to the LDAP server using anonymous credentials,
+ * using a simple bind without username/password
+ *
  * @param ads Pointer to an existing ADS_STRUCT
  * @return status of connection
  **/
-ADS_STATUS ads_connect_anon(ADS_STRUCT *ads)
+ADS_STATUS ads_connect_simple_anon(ADS_STRUCT *ads)
 {
        struct cli_credentials *creds = NULL;
        ADS_STATUS status;
@@ -1139,7 +1174,8 @@ ADS_STATUS ads_connect_anon(ADS_STRUCT *ads)
 }
 
 /**
- * Connect to the LDAP server using without a bind at all
+ * Connect to the LDAP server using without a bind
+ * and without a tcp connection at all
  * @param ads Pointer to an existing ADS_STRUCT
  * @return status of connection
  **/
@@ -3694,7 +3730,6 @@ ADS_STATUS ads_current_time(ADS_STRUCT *ads)
                 */
                ads_s->config.flags = 0;
 
-               ads->auth.flags &= ~ADS_AUTH_NO_BIND;
                status = ads_connect_anon(ads_s);
                if ( !ADS_ERR_OK(status))
                        goto done;
@@ -3784,7 +3819,6 @@ ADS_STATUS ads_domain_func_level(ADS_STRUCT *ads, uint32_t *val)
                 */
                ads_s->config.flags = 0;
 
-               ads->auth.flags &= ~ADS_AUTH_NO_BIND;
                status = ads_connect_anon(ads_s);
                if ( !ADS_ERR_OK(status))
                        goto done;

diff --git a/source3/librpc/idl/ads.idl b/source3/librpc/idl/ads.idl
index 381447a1a2969b17f4162f5f5f1ce7ea988b82ea..81d1fc3861cdbf4b79e5e2617740ec6eb2d03e0b 100644 (file)
--- a/source3/librpc/idl/ads.idl
+++ b/source3/librpc/idl/ads.idl
@@ -29,7 +29,8 @@ interface ads
                ADS_AUTH_SASL_FORCE             = 0x0080,
                ADS_AUTH_SASL_STARTTLS          = 0x0200,
                ADS_AUTH_SASL_LDAPS             = 0x0400,
-               ADS_AUTH_GENERATE_KRB5_CONFIG   = 0x0800
+               ADS_AUTH_GENERATE_KRB5_CONFIG   = 0x0800,
+               ADS_AUTH_CLDAP_ONLY             = 0x1000
        } ads_auth_flags;
 
        const int ADS_SASL_WRAPPING_IN_MAX_WRAPPED = 0x0FFFFFFF;